IMSI provided + null cipher analyzer

[wgreenberg]

Added analyzers for whenever the UE provides an IMSI at all, or when a null cipher was set. Also, because I was having trouble finding which messages contained the IMSI datatype, I wrote a little python script that'll parse and search for datatypes in our ASN.1 files, and print any hits as a "path". For example:

» python asn1grep.py IMSI                                  
searching for IMSI
PCCH-Message [message [message.c1 [c1 [c1.paging [paging [pagingRecordList[0] [ [ue-Identity [ue-Identity.imsi [IMSI]]]]]]]]]]

[cooperq]

it might be worth doing some metacoding eventually so new heuristics are automatically pulled in and we don't have to add this boiler plate. OTOH it might be more work to do that than just add the boilerplate each time.

[cooperq]

I'm not certain paging messages are the only place IMSI would get sent but it seems like a good start. I'm sure an LTE expert will correct us any day now.

[ecen740tamu]

Hi Cooper and Will,
I am good with LTE/5G protocol stack, would you like to see the exhaustive list of all messages that carry IMSI? Sorry, this is Santosh, not ecen740

[wgreenberg]

@ecen740tamu that would be greatly appreciated, thanks Santosh!

[cooperq]

We should also look for the 2G null cipher but this is a good start